CVE-2026-13212: memory-safety in zephyrproject zephyr
Description
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs[] and vq->desc[], which are both allocated with exactly vq->num entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed callback pointer is then invoked as cbe.cb(cbe.opaque, used_len). Because the id is consumed as a 16-bit value with no bound check, a malicious or compromised virtio backend (an untrusted hypervisor, or an untrusted hardware/peer-processor virtio device on a PCI or MMIO transport) can supply an id far beyond vq->num. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory beyond recv_cbs[], after which the driver calls that attacker-shaped pointer in the guest's interrupt context. No guest privileges or user interaction are required; the backend triggers it by writing the shared used ring and raising the queue interrupt. The result is an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e. a control-flow-hijack primitive that can lead to code execution or, at minimum, a reliable crash. The fix rejects any used-ring id >= vq->num before indexing recv_cbs[]/desc[] or invoking the callback. This affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.
CVSS v3.1
Score 8.8high
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Zephyr virtio driver fails to validate the descriptor-chain head id that the virtio device writes into the used ring. In the function virtio_isr() (drivers/virtio/virtio_common.c), the device-provided vq->used->ring[idx].id is used directly as an index into arrays vq->recv_cbs[] and vq->desc[], each allocated with exactly vq->num entries. Because the id is treated as a 16-bit value without bounds checking, a malicious or compromised virtio backend (such as an untrusted hypervisor or hardware device on PCI or MMIO transport) can supply an id beyond vq->num. This causes an out-of-bounds read of a function pointer and argument pair from heap memory beyond recv_cbs[], and the driver then calls this attacker-shaped pointer in the guest's interrupt context. This results in a control-flow hijack primitive that can lead to arbitrary code execution or a crash. The vulnerability affects Zephyr versions 4.2.0 and all versions from 4.2.0 up to but excluding 4.4.2 when built with CONFIG_VIRTIO using PCI or MMIO transport. The fix involves rejecting any used-ring id greater than or equal to vq->num before indexing or invoking callbacks.
Potential Impact
An attacker controlling the virtio backend (such as an untrusted hypervisor or device) can trigger an out-of-bounds read and execute an attacker-influenced function pointer call within the Zephyr guest's interrupt context. This can lead to arbitrary code execution or a reliable crash. No privileges or user interaction are required on the guest side, making this a serious risk in environments where the virtio backend is not fully trusted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects any used-ring id greater than or equal to vq->num before indexing or invoking callbacks, which mitigates the vulnerability. Until an official patch or update is applied, avoid running untrusted virtio backends or isolate the affected Zephyr builds. Monitor vendor communications for an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-24T15:29:15.274Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8c68d6acd9273b49c4d341
Added to database: 08/24/2026, 15:52:54 UTC
Last enriched: 08/24/2026, 16:07:51 UTC
Last updated: 10/07/2026, 06:48:14 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.